5IJOLJOH BCPVU SJTL .BOBHJOH ZPVS SJTL...

Thinking about Risk - Managing your risk appetite: A practitioner's guide 1

CONTENTS

Page

Chapter 1 Overview 3

Chapter 2 Applying risk appetite 7

Annex A Preliminary considerations to take into account prior to determining risk appetite

11

Annex B Discussion framework 13

Annex C A guided walkthough of the assessment process to determine risk appetite

15

Annex D Graphical illustrations 19

Annex E OGC's Risk Dashboard 21

Annex F MCA Risk Matrix 23

Annex G DVLA's Dartboard 27

Annex H Quantifications and Illustrations 29

Annex I Numerical diagnosis - Overview 31

Bibliography 33


1.1 It is essential that the Board's attitude to risk is communicated to the whole organisation and applied in decision making regarding the prioritisation of policies, workstreams, programmes, projects, operational service delivery and the funding that goes with them.

1.2 With the rapid improvement of risk management across Whitehall, many Departments have already introduced a number of innovative and effective approaches to incorporate risk management into their day-to-day business and reform delivery management arrangements.

1.3 The aim of this guide is to help you to refine the application of your organisation’s risk appetite so that risk judgements are more explicit, transparent and consistent. As a practitioner you also need to understand your own risk appetite and how it aligns to that of your organisation. We do not seek to replicate methodologies that have already been covered by other publications, in particular the Orange Book1

and Green Book,2 which this guide is designed to complement.

What is Risk Appetite?

1.4 There are numerous definitions of organisational ‘risk appetite’, but they all boil down to how much of what sort of risk an organisation is willing to take. Risks need to be considered in terms of both opportunities and threats and are not usually confined to money - they will invariably also impact on the capability of your organisation, its performance and its reputation.

1.5 Risk appetite is about taking well thought through risks where the long-term rewards are expected to be greater than any short-term losses. Indeed, it may even be appropriate in some instances to incur a loss if this paves the way to success in the long-run.

1.6 It is worth noting that the Public Accounts Committee supports well-managed risk taking, recognising that innovation and opportunities to improve public services requires risk taking, providing that we have the ability, skills, knowledge and training to manage those risks well.3 This support has also been endorsed by the House of Lords Economic Affairs Select Committee, which is concerned that the public sector reward and assessment systems may emphasise the adverse impact of failure rather than the gains from success and so encourage excessive risk aversion.4

1 The Orange Book: Management of Risk – Principles and Concepts.

2 The Green Book: Appraisal and Evaluation in Central Government.

3 Public Accounts Committee Report – HC444 – Managing Risks to Improve Public Services – March 2005

4 House of Lords Select Committee on Economic Affairs Report – HL Paper 183/1 – Government Policy on Management of Risk.

1 OVERVIEW

For the purpose of this guide we have adopted the Orange Book definition of Risk Appetite, being:

‘The amount of risk that an organisation is prepared to accept, tolerate, or be exposed to at any point in time.’

1 OVERVIEW

4 Thinking about Risk - Managing your risk appetite: A practitioner's guide

1.7 By enhancing your approach to determining risk appetite you will be raising your organisation’s capability to deliver on challenging targets to raise standards, improve service quality, system reform, and provide more value for money. Risk appetite needs to be considered at all levels of the business- from the Ministerial view, which may be influenced by the political climate, down through the business from strategic decisions to operational delivery.

Why do you need to determine your risk appetite?

1.8 If the managers are running the business with insufficient guidance on the levels of risk that are legitimate for them to take, or not seizing important opportunities due to a perception that taking on additional risk is discouraged, then business performance will not be maximised, and business opportunities will not be taken. At the other end of the scale an organisation constantly erring on the side of caution (or one that has a risk averse culture) is one that is likely to stifle creativity and is not necessarily encouraging innovation, nor seeking or exploiting opportunities. You need to be steering a course where risk taking is clearly calculated with a view to achieving defined rewards.

1.9 This Guide is the second part of a set of 3 documents.

1.10 The first part, a Board Paper entitled “Thinking About Risk – Setting and Communicating Your Risk Appetite” explains what risk appetite is and how it depends on the aims of the business. It needs to be considered not only for individual programmes/projects, but also across business areas, units, functions, and in its totality, to ensure that an organisation’s overall portfolio of risks is appropriate, balanced and sustainable.

1.11 This second part, a Practitioner Guide entitled “Thinking About Risk – Managing Your Risk Appetite” explains how to apply risk appetite and provides a guided walk through of an assessment process at Chapter 2 that will:

Help you to incorporate risk appetite into your risk framework

Use the risk appetite when assessing whether risks are being appropriately addressed.

Clearly articulating your risk appetite will have definite business benefits through:

1. Supporting and providing evidence of the decision-making processes.

2. Demonstrating how each element of the business contributes to the overall risk profile.

3. Showing how different resource allocation strategies can add to or lessen the burden of risk.

4. Supporting the approvals process.

5. Identifying specific areas where risks should be removed.

6. Transparency and consistency of business decisions.

7. Improved understanding of risk-based budgets.

OVERV IEW 1


1.12 Annexes D-G provide graphical illustrations of how you might like to diagrammatically represent your risk appetite in relation to the risks of your business. Annexes H and I provide basic information that will help you to further refine those judgements to quantify your risk appetite, if appropriate.

1.13 The final, third part “Thinking About Risk – Managing Your Risk Appetite: Good Practice Examples” illustrates how some Departments have approached their own risk appetite. Whilst no example will be suitable for adoption without modification, we hope that they provide you with useful food for thought.


S t r a t e g i c

P r o g r a m m e

O p e r a t i o n a l

A . D e f in e r is k a p p e t i t e

B . C o m m u n ic a t e s e t g e n e r a l

t o le r a n c e s f o r r is k s I d e n t i f y r e s p o n s e s tm a n a g e r i s k

i t h it o le r a n c e

C . R e p o r t ‘r i s k s ( o u t s id e

t o le r a n c e le v e l )

D A g r e e r e s p o n s e s , p o t e n t ia l ly i n c lu d in g r e v ie w in g r is k a p p e t i t e

Introduction

2.1 Each level of the organisation needs clear guidance on the limits of risk that they can take. Risk appetite should be expressed in the same terms as those used in assessing risk. An organisation’s risk appetite is not necessarily static; in particular the Board will want to vary the amount of risk that it is prepared to take depending on the circumstances at the time. The model below sets out these concepts in more detail:

2.2 Risk appetite is not a magic number, nor always quantifiable. It is dependent upon the aims of the business and what risks have to be taken to achieve those aims. However, those risks must be well-considered and well-managed. To be so, an organisation must provide guidance on the acceptable level of risk that it considers appropriate across the breadth of its business (i.e. risk appetite). Risk appetite needs to be considered not only for individual programmes/projects, but also across operational delivery areas and, in its totality, for the overall portfolio5 of risks to ensure that an organisation’s risks are appropriate, balanced and sustainable.

2.3 At the organisational level risk appetite can become complicated, but at the level of a specific risk it is more likely that a level of exposure6 (consequences) that is acceptable can be defined in terms of both an impact if a risk occurs, and the frequency of that impact. It is against this that the residual risk7 has to be compared to decide whether or not further action is required. What is tolerable may be affected by the value of assets lost or wasted in the event of an adverse impact; stakeholder perception of such an impact; the cost of implementing actions to further manage the risk; the likelihood of the risk occurring; and the balance of potential benefit to be gained.

Need for Guidance

2.4 If your Organisation has not made a formal statement on its risk appetite, you will have a control problem. Without such a statement managers are running their business with insufficient guidance on the levels of risk that they are permitted to take, or not seizing important opportunities due to a perception that taking on additional risk is discouraged. Your role is to help the board set and communicate the risk appetite as

5 The overall portfolio of risks that the organisation is exposed to = Risk Profile

6 Exposure = the consequences, as a combination of impact and likelihood, which may be experienced by the organisation if a specific risk is realised.

7 Residual Risk = the exposure arising from a specific risk after action has been taken to manage it and making the assumption that the action is effective.

2 APPLYING RISK APPETITE

2 APPLY ING R I SK APPET ITE


set out in the Board Paper “Thinking About Risk – Setting & Communicating Your Risk Appetite”.

2.5 The need for guidance was underlined in the PAC Report,8 concluding that:

Departments should signal clearly their commitment at Board-level to taking managed risks that can deliver tangible improvements in services; and

Departmental management boards need to form an overall view on the one hand, greater risk taking is justified (for example in new policy initiatives) and where they need to minimise risks (for example in essential service delivery on which citizens depend).

2.6 There is also a need for a management culture and supporting processes that allow due consideration of risk before major decisions are taken to begin new policy projects or corporate change initiatives and during the development and implementation of programmes of work.

Steps towards embedding the Board's Risk Appetite

2.7 At its simplest, each risk needs to be assessed against the risk appetite that must be determined by the Board and communicated. A framework is needed for describing and analysing risks and assessing them according to a common currency or set of metrics. An overview of the three issues of communication, assessment and metrics is given at Annex C. This approach will give you the basis for improving the consistency of risk decisions.

2.8 It is helpful to have risks classified into categories and mapped to business areas. This allows you to see the way in which risks impact different parts of the business and to what extent some parts of the business have an unacceptable level of risk (either too high or too low). Risk registers that simply list risks individually with their ratings may not indicate how the ratings compare to the risk appetite. They may also fail to facilitate the identification of pressure points, imbalances and inconsistencies in approach.

2.9 One solution is to assign risks to risk categories and then produce a matrix relating categories of risk, such as operational or reputational, to the type of response, on a scale of risk averse to risk hungry, which the different categories of risk would typically evoke.

2.10 Annex A provides a basic framework for doing this showing the factors to consider against each risk category. It also gives examples of the sorts of scales that can be used to distinguish levels of risk appetite. Example 1 in “Thinking About Risk – Managing Your Risk Appetite: Good Practice Examples” shows how DTI have applied this technique.

2.11 Annex B shows a framework that describes the attitudes and behaviours the risk appetite should give rise to for each risk category. This framework may be useful when assessing the adequacy of the responses to risk and in communicating the Board's risk appetite to the whole organisation.

8 Public Accounts Committee Report – HC444 – Managing Risks to Improve Public Services – March 2005

APPLY ING R I SK APPET ITE 2


2.12 With the risk appetite so defined individual risks can be assessed against the risk appetite descriptors and decisions can be made about whether the optimum level of residual risk has been reached. There are many techniques now in use for illustrating this graphically and these are shown in Annexes D & E. A variety of tools are given at Annexes F to I showing how the application of risk appetite can be demonstrated by explicit decisions about the acceptability of specific levels of risk.


1. Identify the group(s) of risks that you have:

For example:

Grouping / Business Area Factors to consider prior to determining your risk appetite include:

Policy / Guidance / Strategic / Political / Change

Business Objectives.

Extent of Innovation.

Robustness of Control Framework.

Operational Delivery / Service Delivery / People / Equality and Diversity

Internal Systems /

Health & Safety

Constraints imposed by existing controls & systems.

Skill remits, stakeholders

Implementation of new systems/procedures and the risks that will be ran to realise their full benefits.

Need to continue to deliver ‘business as usual’

Regularity / Propriety /

Compliance /

Accountability / Financial Loss or Cost

Spending limits.

Regularity & propriety.

Value for money.

Accountability to Ministers and Parliament.

Reputation /

Credibility /

Public Perception /Confidence

Degree of experience.

Historical evidence.

Lessons learned from past crises.

External Factors /

Environmental /Social

The extent and robustness of continuity and contingency plans, to ameliorate exposure to external factors, over which there is limited control.

APRELIMINARY CONSIDERATIONS TO TAKE

INTO ACCOUNT PRIOR TO DETERMINING

RISK APPETITE

A PREL IMINARY CONS IDERAT IONS TO TAKE INTO ACCOUNT PR IOR TO DETERMIN ING RISK APPET ITE


2. Describe your Risk Rankings:

For example:

Ranking Description and Action Needed

Very High This is above the organisation’s defined tolerance level. The consequences of the risk materialising would have a disastrous impact on the organisation’s reputation and business continuity. Comprehensive action is required immediately to mitigate the risk.

High The consequences of this risk materialising would be severe but not disastrous. Some immediate action is required to mitigate the risk, plus the development of a comprehensive action plan.

Medium The consequences of this risk materialising would have a moderate impact on day-to-day delivery. Some immediate action might be required to address risk impact, plus the development of an action plan. Status of the risk should be monitored regularly.

Low The consequences of this risk materialising would have a minor impact. No immediate action is required, but an action plan should be actively considered. Status of the risk should be monitored periodically.

Very Low The organisation accepts this risk / impact of risk would be insignificant. Status of the risk should be reviewed occasionally.

3. Articulate your classifications of Risk Appetite:

For example:

Classification Description

Averse Avoidance of risk and uncertainty is a key Organisational objective.

Minimalist Preference for ultra-safe business delivery options that have a low degree of inherent risk and only have a potential for limited reward.

Cautious Preference for safe delivery options that have a low degree of residual risk and may only have limited potential for reward.

Open Willing to consider all potential delivery options and choose the one that is most likely to result in successful delivery while also providing an acceptable level of reward (and value for money etc.).

Hungry Eager to be innovative and to choose options offering potentially higher business rewards, despite greater inherent risk.

1A

vers

e

2M

inim

alis

t

3C

auti

ous

4 Ope

n

5H

ungr

y

Avo

idan

ce o

f ris

k an

d un

cert

aint

y is

a k

ey

Org

anis

atio

nal o

bjec

tive

Pre

fere

nce

for

ultr

a-sa

fe

busi

ness

del

iver

y op

tion

s th

at

have

a lo

w d

egre

e of

inhe

rent

ri

sk a

nd o

nly

have

a p

oten

tial

for

limit

ed r

ewar

d.

Pre

fere

nce

for

safe

del

iver

y op

tion

s th

at h

ave

a lo

w d

egre

e of

in

here

nt r

isk

and

may

onl

y ha

ve

limit

ed p

oten

tial

for

rew

ard.

Will

ing

to c

onsi

der

all p

oten

tial

de

liver

y op

tion

s an

d ch

oose

the

on

e th

at is

mos

t lik

ely

to r

esul

t in

suc

cess

ful d

eliv

ery

whi

le a

lso

prov

idin

g an

acc

epta

ble

leve

l of

rew

ard

(and

val

ue fo

r m

oney

et

c.).

Eag

er t

o be

inno

vati

ve a

nd t

o ch

oose

opt

ions

offe

ring

po

tent

ially

hig

her

busi

ness

re

war

ds (

desp

ite

grea

ter

inhe

rent

ris

k).

Cat

egor

y of

R

isk

Exa

mpl

e be

havi

ours

whe

n ta

king

key

dec

isio

ns…

Rep

utat

ion

and

cred

ibili

ty

Min

imal

tol

eran

ce fo

r an

y de

cisi

ons

that

cou

ld le

ad t

o sc

rutin

y of

the

Gov

ernm

ent

or

the

Dep

artm

ent.

Tol

eran

ce fo

r ri

sk t

akin

g lim

ited

to

thos

e ev

ents

whe

re t

here

is n

o ch

ance

of a

ny s

igni

fican

t re

perc

ussi

on fo

r th

e G

over

nmen

t or

the

Dep

artm

ent.

Tol

eran

ce fo

r ri

sk t

akin

g lim

ited

to

thos

e ev

ents

whe

re t

here

is li

ttle

ch

ance

of a

ny s

igni

fican

t re

perc

ussi

on fo

r th

e G

over

nmen

t or

the

Dep

artm

ent

shou

ld t

here

be

a fa

ilure

.

App

etite

to

take

dec

isio

ns w

ith

pote

ntia

l to

expo

se t

he

Gov

ernm

ent

or D

epar

tmen

t to

ad

ditio

nal s

crut

iny

but

only

whe

re

appr

opri

ate

step

s ha

ve b

een

take

n to

min

imis

e an

y ex

posu

re.

App

etite

to

take

dec

isio

ns t

hat

are

likel

y to

bri

ng s

crut

iny

of t

he

Gov

ernm

ent

or D

epar

tmen

t bu

t w

here

pot

entia

l ben

efits

out

wei

gh

the

risk

s.

Ope

rati

onal

an

d po

licy

deliv

ery

Def

ensi

ve a

ppro

ach

to o

bjec

tives

–

aim

to

mai

ntai

n or

pro

tect

, ra

ther

tha

n to

cre

ate

or in

nova

te.

Prio

rity

for

tight

man

agem

ent

cont

rols

and

ove

rsig

ht w

ith

limite

d de

volv

ed d

ecis

ion

mak

ing

auth

ority

.

Gen

eral

avo

idan

ce o

f sys

tem

s /

tech

nolo

gy d

evel

opm

ents

.

Inno

vatio

ns a

lway

s av

oide

d un

less

es

sent

ial.

Dec

isio

n m

akin

g au

thor

ity h

eld

by

seni

or m

anag

emen

t.

Onl

y es

sent

ial s

yste

ms

/ tec

hnol

ogy

deve

lopm

ents

to

prot

ect

curr

ent

oper

atio

ns.

Ten

denc

y to

stic

k to

the

sta

tus

quo,

in

nova

tions

gen

eral

ly a

void

ed u

nles

s ne

cess

ary.

Dec

isio

n m

akin

g au

thor

ity g

ener

ally

he

ld b

y se

nior

man

agem

ent.

Syst

ems

/ tec

hnol

ogy

deve

lopm

ents

lim

ited

to im

prov

emen

ts t

o pr

otec

tion

of c

urre

nt o

pera

tions

.

Inno

vatio

n su

ppor

ted,

with

de

mon

stra

tion

of c

omm

ensu

rate

im

prov

emen

ts in

man

agem

ent

cont

rol.

Syst

ems

/ tec

hnol

ogy

deve

lopm

ents

co

nsid

ered

to

enab

le o

pera

tiona

l de

liver

y.

Res

pons

ibili

ty fo

r no

n-cr

itica

l de

cisi

ons

may

be

devo

lved

.

Inno

vatio

n pu

rsue

d –

desi

re t

o ‘b

reak

the

mou

ld’ a

nd c

halle

nge

curr

ent

wor

king

pra

ctic

es.

New

tec

hnol

ogie

s vi

ewed

as

a ke

y en

able

r of

ope

ratio

nal d

eliv

ery.

Hig

h le

vels

of d

evol

ved

auth

ority

–

man

agem

ent

by t

rust

rat

her

than

tig

ht c

ontr

ol.

Fina

ncia

l/VFM

Avo

idan

ce o

f fin

anci

al lo

ss is

a k

ey

obje

ctiv

e.

Onl

y w

illin

g to

acc

ept

the

low

co

st o

ptio

n.

Res

ourc

es w

ithdr

awn

from

non

-es

sent

ial a

ctiv

ities

.

Onl

y pr

epar

ed t

o ac

cept

the

po

ssib

ility

of v

ery

limite

d fin

anci

al

loss

if e

ssen

tial.

VfM

is t

he p

rim

ary

conc

ern.

Prep

ared

to

acce

pt t

he p

ossi

bilit

y of

so

me

limite

d fin

anci

al lo

ss.

VfM

stil

l the

pri

mar

y co

ncer

n bu

t w

illin

g to

als

o co

nsid

er t

he b

enef

its.

Res

ourc

es g

ener

ally

res

tric

ted

to

core

ope

ratio

nal t

arge

ts.

Prep

ared

to

inve

st fo

r re

war

d an

d m

inim

ise

the

poss

ibili

ty o

f fin

anci

al

loss

by

man

agin

g th

e ri

sks

to a

to

lera

ble

leve

l.

Val

ue a

nd b

enef

its c

onsi

dere

d (n

ot

just

che

apes

t pr

ice)

.

Res

ourc

es a

lloca

ted

in o

rder

to

capi

talis

e on

pot

entia

l opp

ortu

nitie

s.

Prep

ared

to

inve

st fo

r th

e be

st

poss

ible

rew

ard

and

acce

pt t

he

poss

ibili

ty o

f fin

anci

al lo

ss (

alth

ough

co

ntro

ls m

ay b

e in

pla

ce).

Res

ourc

es a

lloca

ted

with

out

firm

gu

aran

tee

of r

etur

n –

‘inve

stm

ent

capi

tal’

type

app

roac

h.

Com

plia

nce

– le

gal /

re

gula

tory

Avo

id a

nyth

ing

whi

ch c

ould

be

chal

leng

ed, e

ven

unsu

cces

sful

ly

Play

saf

e.

Wan

t to

be

very

sur

e w

e w

ould

win

an

y ch

alle

nge.

Li

mite

d to

lera

nce

for

stic

king

our

ne

ck o

ut.

Wan

t to

be

reas

onab

ly

sure

we

wou

ld w

in a

ny c

halle

nge.

Cha

lleng

e w

ill b

e pr

oble

mat

ic b

ut

we

are

likel

y to

win

it a

nd t

he g

ain

will

out

wei

gh t

he a

dver

se

cons

eque

nces

.

Cha

nces

or

losi

ng a

re h

igh

and

cons

eque

nces

ser

ious

. Bu

t a

win

w

ould

be

seen

as

a gr

eat

coup

.


B DISCUSSION FRAMEWORK

GO T

O:

C.2

Risk

App

etite

-M

ETRI

CS

1. L

angu

age:

Is t

here

a c

omm

on u

nder

stan

ding

of r

isk

man

agem

ent

con

cept

s th

roug

hout

you

r or

gani

satio

n?

Hav

e yo

u de

fined

you

r in

terp

reta

tion

of r

isk

appe

tite

[For

exa

mpl

es, s

ee A

nnex

B]

5. B

oard

Lev

el C

omm

itm

ent:

Is t

here

a S

enio

r O

wne

r fo

r al

l sig

nific

ant

risk

s?

Do

all s

igni

fican

t pr

ojec

ts/p

rogr

amm

es h

ave

a Sp

onso

r at

Boa

rd L

evel

?

Doe

s th

e Sp

onso

r ha

ve a

suf

ficie

ntly

bro

ad r

emit

to p

rovi

de e

ffect

ive

scru

tiny

of t

he p

roje

ct/p

rogr

amm

e an

d is

tha

t ex

erci

sed?

3. M

inis

teri

al D

ialo

gue:

Is t

here

ope

n di

alog

ue w

ith y

our

Min

iste

r?

Are

min

iste

rial

pre

sent

atio

ns c

onci

se, y

et c

ompr

ehen

sive

and

sui

tabl

y fo

rmat

ted?

[D

o yo

u kn

ow

wha

t th

ey w

ant?

Do

they

kno

w w

hat

is a

vaila

ble]

Is y

our

Min

iste

r aw

are

of a

ll ev

iden

ce, e

ven

whe

n th

ere

are

con

flict

ing

opin

ions

?

Is y

our

Min

iste

r no

tifie

d of

all

optio

ns a

nd t

he im

plic

atio

ns (

pros

& c

ons)

of e

ach,

so

that

the

y ar

e en

able

d to

tak

e a

fully

info

rmed

dec

isio

n?

C.1

Risk

Appe

tite

–CO

MM

UNIC

ATIO

N

2. G

uida

nce:

Is c

ompr

ehen

sive

ris

k m

anag

emen

t gu

idan

ce a

vaila

ble

to a

ll

staf

f?

Is it

up

to d

ate

and

in a

n ac

cess

ible

form

at?

Are

sta

ff aw

are

of it

s ex

iste

nce

and

whe

re t

o fin

d it?

6. S

ucce

ss M

easu

res:

Do

you

know

wha

t co

nstit

utes

suc

cess

?

Do

you

know

wha

t ar

e th

e m

inim

um a

mou

nt/le

vel o

f ben

efits

you

nee

d to

ach

ieve

suc

cess

?

Hav

e yo

u se

t yo

ur s

ucce

ss m

easu

res

(whi

ch m

ay b

e di

ffere

nt fo

r di

ffere

nt p

roje

cts/

prog

ram

mes

?

Hav

e yo

u se

t, de

fined

and

com

mun

icat

ed y

our

para

met

ers

of w

hat

is/ i

s no

t a

ccep

tabl

e?

Hav

e yo

u se

t yo

ur a

utho

risa

tion

leve

ls fo

r th

ose

para

met

ers?

4. C

ultu

re:

Do

the

Boar

d co

nsci

ousl

y de

mon

stra

te t

heir

att

itude

to

risk

?

Are

sta

ff’ a

war

e of

the

Boa

rd’s

att

itude

to

risk

?

Do

staf

f sha

re t

he s

ame

attit

ude

to r

isk?

[O

r, in

pra

ctic

e is

the

re a

ten

denc

y to

be

reck

less

or

to p

lay

ultr

a sa

fe?]

Are

the

re in

tern

al p

ress

ures

tha

t af

fect

ris

k m

anag

emen

t pr

actic

es?

[Eg.

Too

sho

rt le

ad t

imes

, lea

ding

to

shor

tcut

s]

Are

the

re e

xter

nal p

ress

ures

tha

t in

crea

se y

our

orga

nisa

tion’

s vu

lner

abili

ty?

[Eg.

Ext

erna

l reg

ulat

ors?

3rd

part

y fu

ndin

g?]

Doe

s th

e m

anag

emen

t st

ruct

ure

of y

our

orga

nisa

tion

faci

litat

e an

d en

cour

age

the

esca

latio

n of

ris

k? [

Are

con

cern

s go

ing

to b

e br

ough

t to

you

r at

tent

ion

at t

he e

arlie

st o

ppor

tuni

ty?]

Doe

s th

e or

gani

satio

n ha

ve in

ter-

depe

nden

cies

with

oth

er G

over

nmen

t or

gani

satio

ns (

eg D

epts

, ND

PBs,

Age

ncie

s)


C A GUIDED WALKTHOUGH OF THE ASSESSMENT

PROCESS TO DETERMINE RISK APPETITE

AN

NEX

B –

Slid

e 3A

NN

EX B

–Sl

ide

3

GO

TO

:C

.3 R

isk

App

etit

e -

ASS

ESS

ME

NT

3. E

vide

nce:

Do

you

know

wha

t da

ta w

ill b

e av

aila

ble?

Will

tha

t da

ta m

eet

the

requ

irem

ents

for

your

mea

sure

men

ts?

If no

t, ca

n ad

ditio

nal d

ata

be r

eadi

ly o

btai

ned?

Do

you

know

whe

n an

d ho

w t

hat

data

will

be

gath

ered

?

Is t

he d

ata

colle

ctio

n fe

asib

le, o

r w

ill it

be

too

oner

ous

to b

eun

dert

aken

reg

ular

ly &

con

sist

ently

?

Do

you

have

suf

ficie

nt r

esou

rces

to

proc

ess

the

data

gat

here

d?

C.2

Risk

App

etite

–M

ETRI

CS

4. E

xpos

ure:

For

Cor

pora

te R

isk

App

etit

e

Has

the

Boa

rd /

Snr

Man

ager

s ju

dged

the

tol

erab

le r

ange

of e

xpos

ure

for

the

Org

anis

atio

n?

Hav

e th

ey id

entif

ied

the

gene

ral b

ound

arie

s fo

r un

acce

ptab

le r

isk

/ ri

sks

that

mus

t be

esc

alat

ed u

p to

the

Boa

rd fo

r de

cisi

on a

s/w

hen

they

ar

ise?

For

Pro

ject

s / D

eleg

ated

Ris

k A

ppet

ite

Hav

e th

e T

arge

ts a

nd K

PIs

set

been

aut

hori

sed

by t

he S

pons

or?

Com

pare

d to

the

tar

gets

you

’ve

set,

have

you

set

the

leve

ls o

f ac

cept

abili

ty?

Hav

e th

e ‘a

ccep

tabi

lity

leve

ls’b

een

appr

oved

by

the

Spon

sor?

Do

you

know

wha

t le

vel o

f exp

osur

e is

con

side

red

tole

rabl

e?

1. S

ucce

ss:

Doe

s ev

eryo

ne o

n w

hom

you

r pr

ojec

t/pr

ogra

mm

e im

pact

s kn

ow w

hat

cons

titut

es s

ucce

ss?

Doe

s ev

eryo

ne in

volv

ed k

now

wha

t th

e ob

ject

ives

of y

our

proj

ect/

prog

ram

me

are?

Do

you

know

whe

ther

(or

not

) yo

u ar

e on

cou

rse

to a

chie

ve t

hose

ob

ject

ives

?

2. M

easu

rem

ents

:

Hav

e yo

u de

term

ined

wha

t m

etho

ds y

ou a

re g

oing

to

use

to m

easu

reth

e pr

ogre

ss o

f you

r pr

ojec

t?

[Eg

. A

nnex

C, S

lide

5]

Hav

e K

ey P

erfo

rman

ce T

arge

ts &

Indi

cato

rs b

een

set?

Hav

e W

arni

ng In

dica

tors

bee

n se

t so

tha

t an

ale

rt is

rai

sed

whe

na

Tar

get

/ K

PI g

oes

off c

ours

e, b

efor

e no

n-at

tain

men

t is

cri

tical

?

C A GUIDED WALKTHOUGH OF THE ASSESSMENT PROCESS TO DETERMINE R I SK APPET ITE


8. D

ecis

ion

Mak

ing:

Doe

s th

e pr

ojec

t/pr

ogra

mm

e fit

with

the

bus

ines

s’s

prio

ritie

s?

Wha

t ty

pe o

f pro

ject

is it

–sp

ecul

ativ

e, p

ilot

or s

tand

ard?

Is it

mis

sion

cri

tical

?

Is d

eliv

ery

relia

nt u

pon

inte

r-de

pend

enci

es w

ith o

ther

Gov

t or

gns,

con

trac

tors

or

othe

r 3r

dpa

rtie

s?

Is t

he s

ize

of t

he p

roje

ct r

elat

ive

to t

he t

he s

ize

of t

he b

usin

ess?

How

goo

d is

you

r de

liver

y pe

rfor

man

ce?

Is t

here

a h

isto

ry o

f leg

acy

issu

es t

o be

tac

kled

?

Do

you

have

a t

ende

ncy

to r

epea

tedl

y fa

ce t

he s

ame

diffi

culti

es (

ie P

IR le

sson

s ar

e no

t be

ing

lear

nt /

ther

e is

lit

tle e

mbe

dded

lear

ning

.

7. R

esou

rce

Ava

ilabi

lity:

Can

you

rea

dily

fina

nce

the

proj

ect/

prog

ram

me?

Will

you

be

depe

nden

t up

on 3

rdpa

rty

fund

ing?

Is t

his

fund

ing

secu

re?

Do

you

have

eno

ugh

peop

le, w

ith t

he r

ight

ski

lls in

-hou

se, t

o be

abl

e to

ser

vice

the

pro

ject

/pro

gram

me

in a

dditi

on t

o th

eir

curr

ent

wor

kloa

ds?

If no

t -

Can

exi

stin

g w

ork

be d

efer

red

or d

eleg

ated

?C

an y

ou a

fford

to

outs

ourc

e/bu

y-in

ski

lls?

Are

you

dep

ende

nt u

pon

key

pers

onne

l?

Are

you

pro

vidi

ng s

uffic

ient

tra

inin

g &

wor

k ex

peri

ence

to

prov

ide

for

succ

essi

on p

lann

ing?

Are

you

dep

ende

nt u

pon

new

/inno

vativ

e te

chno

logy

or

syst

ems?

Do

you

have

suf

ficie

nt t

ime

with

in w

hich

to

com

fort

ably

del

iver

the

pro

ject

/pro

gram

me,

allo

win

g fo

r co

ntin

genc

y ar

rang

emen

ts?

C.3

Risk

App

etite

–AS

SESS

MEN

T

3. ‘

Tre

at’:

Can

ris

ks b

e tr

eate

d?

If ye

s –

Will

/hav

e m

itiga

ting

man

agem

ent

cont

rols

be

put

in p

lace

?W

ill t

he r

esid

ual r

isks

be

acce

ptab

le?

1. T

oler

abili

ty:

Do

you

know

wha

t le

vel o

f ris

k yo

u co

nsid

er t

o be

tol

erab

le, g

iven

the

exp

osur

e?

Are

the

ris

ks u

ncer

tain

?

If so

, do

you

know

why

?

Can

the

pro

ject

/pro

gram

me

be c

onsi

dere

d ra

dica

l/inn

ovat

ive?

Doe

s yo

ur p

roje

ct/p

rogr

amm

e gi

ve r

ise

to a

n op

port

unity

to

expl

oit

posi

tive

impa

cts?

Doe

s yo

ur p

roje

ct /

prog

ram

me

give

ris

e to

an

oppo

rtun

ity t

o ex

ploi

t po

sitiv

e im

pact

s?

If th

e in

here

nt r

isks

are

tol

erab

le, c

an t

hey

be a

ccep

ted

as t

hey

stan

d?

2. A

ddre

ss R

isks

:

If th

e in

here

nt r

isks

are

not

acc

epta

ble

–

Is t

here

a p

ositi

ve C

ost/

Bene

fit A

naly

sis

to s

uppo

rt t

akin

g on

the

ris

k(s)

of

the

pro

ject

?

Are

you

abl

e to

‘tre

at’ ,

‘tra

nsfe

r’ o

r te

rmin

ate

the

risk

?[S

ee b

oxes

3, 4

& 5

]

4. ‘

Tra

nsfe

r’:

Can

the

pro

ject

/ris

ks b

e tr

ansf

erre

d?

Are

you

aw

are

of t

he r

esid

ual r

espo

nsib

ility

you

will

hav

e fo

r th

e pr

ojec

t?

Will

the

con

trac

t be

clo

sely

man

aged

?

Will

the

re b

e m

onito

ring

of p

roje

ct p

rogr

ess

agai

nst

the

busi

ness

obj

ectiv

es?

Can

you

han

dle

any

on-c

osts

or

ram

ifica

tions

of o

utso

urci

ng t

he

proj

ect/

prog

ram

me?

5. ‘

Ter

min

ate’

:

Can

the

pro

ject

/ris

k be

ter

min

ated

?If

yes

-W

ill t

he im

pact

be

sign

ifica

nt?

Are

you

aw

are

of t

he c

onse

quen

tial r

isks

?

If no

–A

re y

ou a

pro

vide

r of

last

res

ort?

Can

the

ser

vice

pro

visi

on b

e ch

ange

d?C

an t

he m

eans

of d

eliv

ery

be c

hang

ed?

Will

any

cha

nges

nee

d in

nova

tion?

6. R

eput

atio

n:A

re y

ou fu

lly a

war

e of

the

rep

utat

iona

l ris

ks a

ssoc

iate

d w

ith t

he p

roje

ct/p

rogr

amm

e?H

ow m

uch

impa

ct w

ill t

he p

roje

ct/p

rogr

amm

e ha

ve o

n yo

ur O

rgan

isat

ion?

Can

you

who

lly a

bdic

ate

resp

onsib

ility

for

the

proj

ect/

prog

ram

me?

Wha

t ar

e th

e pu

blic

& m

edia

per

cept

ions

of y

our

risk

s –

do y

ou n

eed

bett

er c

omm

unic

atio

n?

A GU IDED WALKTHOUGH OF THE ASSESSMENT PROCESS TO DETERMINE R I SK APPET ITE C


AN

NEX

B –

Slid

e 3A

NN

EX B

–Sl

ide

3

See

C.2

Ris

k A

ppet

ite

–M

etri

cs

Ris

k an

alys

is a

nd q

uant

ifica

tion

:

•Ev

ent

Bow

Tie

(C

ause

-Eve

nt-E

ffect

)

•Fa

ilure

Mod

e Ef

fect

s [a

nd C

ritic

ality

] A

naly

sis

(FM

EA)

•C

ritic

al P

ath

Ana

lysi

s

•Ba

yesi

an B

elie

f Net

wor

ks

•T

raffi

c lig

ht s

yste

ms

•M

onte

Car

lo s

imul

atio

n

C.4

Risk

App

etite

–Ex

ampl

es o

f M

etrics

and

Risk

Anal

ysis T

echn

ique

s

Fina

ncia

l:

•V

alue

of t

rans

actio

ns

•V

olum

e of

tra

nsac

tions

•V

alue

of i

ncom

e

•V

alue

of e

xpen

ditu

re

•C

apita

l em

ploy

ed

•R

isk

ratin

gs

Dat

a an

alys

is:

•St

atis

tical

Mea

ns, V

aria

nce,

etc

.

•D

istr

ibut

ions

–G

auss

ian

dist

ribu

tion

(nor

mal

), Po

isso

n (e

.g.,

radi

oact

ive

deca

y), e

tc.

•C

orre

latio

n co

effic

ient

(-1

to

1)

•R

egre

ssio

n an

alys

is (

R2)

•R

ate

& Q

uotie

nt a

naly

sis

•D

elph

i ana

lysi

s (q

ualit

ativ

e)

Hum

an r

esou

rces

:

•A

vera

ge a

ge

•A

vera

ge s

alar

y

•R

atio

of m

anag

ers

to s

taff

•R

eten

tion/

turn

over

rat

es

•A

bsen

ce r

ates

•T

rain

ing

spen

d pe

r em

ploy

ee

•D

iver

sity

indi

cato

rs

•N

umbe

r of

vac

anci

es fi

lled

inte

rnal

ly/e

xter

nally

•N

umbe

r of

sta

ff to

num

ber

of p

ensi

oner

s

•Pe

nsio

n lia

bilit

ies

•Lo

ss T

ime

Inju

ry R

ate

For

furt

her

info

rmat

ion

plea

se r

efer

to:

The

Gre

en B

ook

–A

ppra

isal

& E

valu

atio

n in

Cen

tral

Gov

ernm

ent

C A GUIDED WALKTHOUGH OF THE ASSESSMENT PROCESS TO DETERMINE R I SK APPET ITE


1

2

Collectively, it can be used to plot the overall rating of each programme/project, to illustrate the portfolio risk

1 = VL = Insignificant

2 = L = Minor

3 = M = Moderate 4 = H = Major

5 = VH = Catastrophic

=> Tolerability Level

Key:

VH = Catastrophic Consequences / Almost Certain to happen / Unacceptable unless external approval gained - eg. Govt Minister, OGC

H = Major Consequences / Likely to happen / Acceptable only with Board AuthorisationM = Moderate Consequences / Possible Occurrence / Acceptable with Group Director ApprovalL = Minor Consequences / Unlikely to happen / Head of Team or Dept Approval

VL = Insignificant Consequences / Rare Occurrence / Line Mgr or Staff Approval

Organisation (from strategic down to operational). Unacceptable exposure to risk can occur atany level and an effective escalation procedure needs to be in place to ensure that these risks can be escalated to senior managers quickly.

A Single Matrix Approach - where risk appetite is scored against a number of broadcategories that are specific to the Organisation/Area/Activity being assessed

A Hierarchical Matrix Approach - which recognises that risks occur at different levels in an

Control: High Level MonitoringControl: Remedial Action, Senior Level Monitoring

Control: Low Level Monitoring

Control: Urgent Remedial Action, Senior Level Monitoring

1. RISK APPETITE - Single Matrix

1 = VL = Rare

[Example - Would need to be adjusted to reflect delegation levels appropriate to each level]

At root level, this can be used to plot each of the risks associated with a particular programme/project.

IMPACT

Single-Matrix Approach [Tabular Method] - Version 1

2 = L =

4 = H =

3 = M = Possible

5 = VH = Almost

Single-Matrix Approach [Graphical Method]

At root level, this can be used to plot each of the risks associated with a particular programme/project.

Collectively, it can be used to plot the overall rating of each programme/project, to illustrate the portfolio risk

Likelihood

IMPACT

Positive/opportunityNegative/threatHigh…..Medium….Low Low….Medium….High

LIK

ELIH

OO

D

Low

…M

ediu

m…

Hig

h


D GRAPHICAL ILLUSTRATIONS

Key

:

VH

=

Cat

astr

ophi

c C

onse

quen

ces

= U

nacc

epta

ble

unle

ss e

xter

nal a

ppro

val g

aine

d -

eg. G

ovt

Min

iste

r, O

GC

H =

Maj

or C

onse

quen

ces

= A

ccep

tabl

e on

ly w

ith B

oard

Aut

hori

satio

nM

=M

oder

ate

Con

sequ

ence

s =

Acc

epta

ble

with

Gro

up D

irec

tor

App

rova

lL

=M

inor

Con

sequ

ence

s =

Hea

d of

Tea

m /

Dep

t A

ppro

val [

depe

nden

t up

on d

eleg

atio

n le

vel]

VL

=In

sign

ifica

nt C

onse

quen

ces

= Li

ne M

gr /

Staf

f App

rova

l [de

pend

ent

upon

del

egat

ion

leve

l]

Pro

gram

me-

leve

l

5 =

VH

=

Alm

ost

Cer

tain

MM

HV

HV

H

4 =

H =

Lik

ely

MM

HH

VH

3 =

M =

P

ossi

ble

LM

MH

H2

=L

=U

nlik

ely

VL

LM

MM

1 =

VL

= R

are

VL

VL

LM

M

5 =

VH

=

Alm

ost

Cer

tain

MM

HV

HV

H

1 =

VL

= In

sign

ifica

nt2

= L

= M

inor

3 =

M =

M

oder

ate

4 =

H =

M

ajor

5 =

VH

=

Cat

astr

ophi

c4

= H

=

Pro

babl

eM

MH

HV

H3

= M

=

Pos

sibl

eL

MM

HH

2 =

L =

Unl

ikel

yV

LL

MM

M

1 =

VL

= R

are

VL

VL

LM

M

Sign

-off

1 =

VL

= In

sign

ifica

nt2

= L

= M

inor

3 =

M =

M

oder

ate

4 =

H =

M

ajor

5 =

VH

=

Cat

astr

ophi

c

5 =

VH

=

Alm

ost

Cer

tain

MM

HV

HV

H

4 =

H =

P

roba

ble

MM

HH

VH

3 =

M =

P

ossi

ble

LM

MH

H2

= L

= U

nlik

ely

VL

LM

MM

Sign

-off

1 =

VL

= R

are

VL

VL

LM

M

1 =

VL

= In

sign

ifica

nt2

= L

= M

inor

3 =

M =

M

oder

ate

4 =

H =

M

ajor

5 =

VH

=

Cat

astr

ophi

c

Con

trol

: Urg

ent

Rem

edia

l Act

ion,

Sen

ior

Leve

l Mon

itori

ng

<= T

oler

abili

ty L

evel

Likelihood

Con

trol

: Lo

w L

evel

Mon

itori

ngC

ontr

ol:

Hig

h Le

vel M

onito

ring

Con

trol

: Rem

edia

l Act

ion,

Sen

ior

Leve

l Mon

itori

ng

IMP

AC

T

Stra

nd-le

vel

Pro

ject

-leve

l

Esc

alat

ion

Likelihood

IMP

AC

T

<= T

oler

abili

ty L

evel

<= T

oler

abili

ty L

evel

IMP

AC

T

[Exa

mpl

e - W

ould

nee

d to

be

adju

sted

to

refle

ct d

eleg

atio

n le

vels

app

ropr

iate

to

each

leve

l]

Esc

alat

ion

2. RI

SK A

PPET

ITE

- Hie

rarc

hica

l M

atrix

LikelihoodSi

mpl

ified

Ass

essm

ent

- Hie

rarc

hica

l App

roac

hT

his

can

be a

pplie

d to

any

'wor

k' g

roup

ing:

for

exam

ple,

cor

pora

te/d

irec

tora

te/d

ivis

ion;

pro

gram

me/

stra

nd/p

roje

ct e

tc.

Plo

ttin

g ea

ch r

isk

on t

he a

ppro

pria

te t

able

will

sho

w t

he s

prea

d of

ris

k an

d ill

ustr

ate

if th

ere

are

unac

cept

able

ris

ks a

t an

y le

vel w

hich

nee

d es

cala

tion

and

, sim

ilarl

y, if

the

re is

an

unac

cept

able

con

cent

rati

on o

f ris

ks b

eing

car

ried

at

any

leve

l.

D GRAPHICAL I LLUSTRAT IONS



OGC’s Risk Dashboard provides a pictorial representation of risks – individually or in portfolio – showing the appetite for each and their relationship to the risk status inherently [ie before management actions taken to control / mitigate the risk(s)] and residually [ie after management actions have been implemented].

E OGC'S RISK DASHBOARD

Or

Red

Stat

us Amber/ Red

Amber/

Green

Green

1 2 3 4 5 6

Risk Where the appetite is higher than the residual risk, resulting in too much being spent on risk reduction due to averse perception, Inherent status Residual status Appetite


The Maritime and Coastguard Agency (MCA) is an executive agency of the Department for Transport and is responsible for implementing the government’s maritime safety and environmental protection policy. The MCA is also responsible for co-ordinating search and rescue at sea through Her Majesty’s Coastguard, and checking that ships meet UK and international safety rules.

In undertaking assessments of risk for technical maritime safety risk in the commercial shipping sector the MCA follows good practice in the maritime sector. Other approaches are currently used for assessing risk against appetite for cargo losses and environmental harm.

One broadly acceptable measure is the equivalent fatality rate (EFR). This uses the computation that 100 minor injuries and 10 major injuries are each equivalent to a single fatality. The notion of an equivalent fatality rate is drawn from the ‘value of preventing a fatality’ (VPF) and ‘willingness to pay’ (WTP), concepts which underpin the economic evaluation of casualties in the UK. Coupling EFR with the As Low As Reasonably Practicable (ALARP) and tolerability principles expounded by the Health and Safety Executive, and the Formal Safety Assessment principles agreed by the International Maritime Organization, provides a framework to explore the MCA’s risk appetite for commercial shipping, that is, whether a particular position on risk is acceptable. As such the framework is also a useful tool for communication and discussion with stakeholder groups. The framework is illustrated below.

F MCA RISK MATRIX

F MCA RISK MATRIX


MCA’S ‘COST, PERFORMANCE, REPUTATION, PROBABILITY CRITERIA

Financial impact (In a given Financial Year)

Low 1 Medium 2 High 3

Costing <£100k (as a guide)

It is likely to cost this much to manage this risk/gain as much as this from the opportunity compared with similar projects or programmes.

Significant stakeholder interest in the level of loss/gain.

Impact on/improvement to service delivery in other areas to due to financial impact of this occurrence.

It is very likely that the MCA Executive Board will wish to exercise management of this risk until its financial impact is reduced to medium or below. The head of Finance and Contracts is to be alerted when a risk reaches cost impact 3.

Costing £100k to £1m (as a guide)

It has often cost around this sum to manage this risk/ gain as much as this from the opportunity in similar projects or programmes.

Moderate stakeholder concern.

Some impact on/improvement to service delivery in other areas due to the financial impact of this occurrence.The Head of Finance and Contracts is to be alerted when a risk reaches Cost Impact Level 2.

Costing > £1m (as a guide)

It is likely to cost about this much to manage an occurrence of this risk/we might gain as much as this from the opportunity.

Little stakeholder concern and can normally be managed in the directorate/division/branch concerned, with normal reporting to the Head of Finance.

Little impact on/improvement to service delivery in other areas due to the financial impact of this occurrence.

Performance impact

Performance


Has a low level impact on the ability of the Agency to deliver key services.

Not the end of the world…

The impact would be significant at the branch or area level, but would be controllable and would not affect the wider Agency.

An aspect of a Ministerial Target may be affected but the overall target is likely to remain unaffected.

Has a medium level impact on the ability of the Agency to deliver key services.

Minor legislative or policy requirement may not be transposed/delivered.

Key milestones to major project or initiative slip.

Would have a significant impact at the directorate or regional level that may lead to a wider Agency impact.

Has a high level impact on the ability of the Agency to deliver key services.

Major legislative requirement is not delivered with potentially serious implications.

Major failing in the delivery of a key project or initiative.

Significant impact on the delivery of Agency major projects and initiatives.

MCA RISK MATRIX F


REPUTATION IMPACT (FORMERLY TIME IMPACT)

Likelihood

Performance


Negligiblecriticism/negativity.

A low level interest in a particular activity of the Agency.

A sideline in specialist press.

Managed situation, with the Department and the Minister informed with briefings.

Medium level criticism/negativity.

Some national public or media criticism lasting a week.

Sustained criticism over 3-4 months amongst local press and public and/or specialist press e.g. Lloyds List or NAUTILIS Telegraph.

Could take up to 3 months to restore credibility with parent department or external stakeholder such as shipping companies.

Reputation tarnished in the longer term, the Minister maybe criticised for actions undertaken by the Agency.

High level criticism/negativity.

Widespread criticism originating from all quarters of the press, the General Public and other Ministers in Government.

It will take more than 6 months to restore creditability amongst stakeholders and the parent department.

Reputation is irreparably damaged. A massive downturn in flagging-in and confidence amongst existing stakeholders for future decisions we take.

The future of the Agency could be at stake.

F MCA RISK MATRIX


Probability

3 There is more

than a 50%

chance of this risk occurring.

It is highly likely that the risk will materialise.

This occurrence is known to occur in similar projects and programmes. It happens frequently in other Government Departments. There is a strong and public history of occurrence. It has happened before in the MCA. It is likely to happen more than once in the financial year. It has happened recently and publicly. It is more likely to occur than not to occur.

Should have seen it coming.

The occurrence of this risk could be associated with poor management and failure to judge the likelihood of it happening despite strong and public evidence of its existence and the rate of incidence. Alternately, this might be a risk that is completely unavoidable despite all management intervention; effort is directed to minimising its impacts rather than its likelihood of occurrence.

The emergence of this opportunity is associated with good management and is an example of best practice and the ability to learn from past programmes and to apply a careful analysis of the potential outcomes. There was a clear opportunity that can be relied upon with reasonable certainty. It has taken considerable work to accrue the benefits.

2 There is

between 25-

50%

likelihood of

this risk occurring.

It is reasonably likely to occur.

More likely not to occur than to occur. Much less public history of occurrence. Does not often occur in the MCA. Not normally associated with these types of programmes and projects. It sometimes happens in other government departments.

Might have seen it coming. No data and very difficult to predict.

This could have turned out to be a risk or an opportunity depending on many other factors.

1 There is below 25%

likelihood that this risk will occur.

This has never occurred and it is very unlikely to occur.

Has not occurred in the MCA. Unlikely to occur. Not associated with this type of programme and project. Little public history of occurrence. It does not often happen in other government departments.

Could not have seen it coming.

Most unfortunate if this risk occurs despite analysis and strong evidence of it being very unlikely. Nasty shock.

Very lucky to have this opportunity emerge from a situation where there was little expectation of such a favourable outcome. Nice surprise. Alternately this could be an opportunity that is definitely there, but where there is a low chance of reaping the benefits in full, or an opportunity that cannot be clearly defined at this stage.


This is a prototype diagram that DVLA are currently looking to trial. Whilst this looks complex hopefully the explanation will reveal how simple this is!

Think of the circle as a classic risk management traffic light (but with 2 ambers!!) each of the lines relates to a specific risk off the corporate risk register, the 3 markers relate to, 1. The worst case scenario- the black triangle is the inherent risk, 2.the white square is the best case scenario – think of this as minimising the residual risk, and the purple symbol, gives the current position.

So to take specific examples, is risk E being over managed as the activity, purple symbol, is being managed down to a target that may exceed the organisations requirement. Similarly, for risk J do we want to manage this more aggressively, or perhaps be more realistic on how much risk to accept?

G DVLA'S DARTBOARD


H.1 Monetary quantification is not always possible or desirable. However, if you would like to refine the judgements that you have made through following the Practitioner Guide (Chapter 2) it is possible to rate or rank those judgments according to the likelihood that the risk will occur, and the impact that it will then have on your business.

H.2 The preliminary considerations that you will need to take into account prior to attaching numerical values to risk appetite are:

1. How do you describe the likelihood that a risk will occur?

For example:

Rank Rating Description

1 Rare <W% (say less than 5%) likelihood of impact happening

2 Unlikely W% to X% (say 5 to 20%) likelihood of occurrence

3 Possible X% to Y% (say 20% to 50%) likelihood of occurrence

4 Likely Y% to Z% (say 50% to 80%) likelihood of occurrence

5 Almost Certain >Z% (say over 80%) likelihood of impact happening

2. How do you describe the impact of the risks on your business?

For example:

Rank Rating

1 Insignificant

2 Minor

3 Moderate

4 Major

5 Catastrophic

H QUANTIFICATIONS AND ILLUSTRATIONS

H QUANTIF ICAT IONS AND ILLUSTRAT IONS


3. How do you illustrate your Risk?

For example, pictured as black, red, amber/red, amber/green, or green

Before controls, the risk is classed as inherent. After controls/management actions the risk is classed as residual. The inherent risk will determine the original status of the risk, as below: (first rating is impact; the second is likelihood)

Colour (Status) Rating [impact / likelihood]

Black 5/5, 5/4, 4/5

Red 5/3, 3/5, 4/4, 4/3, ¾

Amber/Red 5/2, 4/2, 3/2, 3/3, 2/3 2/4, 2/5

Amber/Green 5/1, 4/1, 2/2, 1/4, 1/5

Green 3/1, 2/1, 1/1, 1/2, 1/3

Risk Owners need to use this to assess whether their current exposure is reasonable or is in need of attention - eg is “green” or “amber/green” acceptable? – and if so for how long?

If the Residual Risk following management actions remains higher than the Organisation’s Risk Appetite, it indicates that further actions are required.

4. L

ikel

ihoo

d C

rite

ria.

(The

cha

nces

of a

ris

k oc

curr

ing)

Scor

eR

ange

Des

crip

tion

(in

per

iod)

5V

.hig

hA

lmos

t ce

rtai

n4

Hig

hLi

kely

3M

ediu

mPo

ssib

le2

Low

Unl

ikel

y1

V. L

owR

are

1.A

sses

smen

t:

Som

e ty

pes

of r

isk

lend

the

mse

lves

to

a nu

mer

ical

dia

gnos

is –

part

icul

arly

fina

ncia

l ris

k.

For

othe

r ri

sks

-fo

r ex

ampl

ere

puta

tiona

lris

k -

a m

uch

mor

e su

bjec

tive

view

is a

ll th

at is

pos

sibl

e. I

n th

is s

ense

ris

k as

sess

men

t is

mor

e of

an

art

than

a s

cien

ce.

It w

ill b

e ne

cess

ary,

how

ever

, to

deve

lop

som

e fr

amew

ork

for

asse

ssin

g ri

sks.

The

ass

essm

ent

shou

ld

draw

as

muc

h as

pos

sibl

e on

unb

iase

d in

depe

nden

t ev

iden

ce, c

onsi

der

the

pers

pect

ives

of t

he w

hole

ran

ge o

f st

akeh

olde

rs a

ffect

ed b

y th

e ri

sk, a

nd a

void

con

fusi

ng o

bjec

tive

asse

ssm

ent

of t

he r

isk

with

judg

emen

t ab

out

the

acce

ptab

ility

of t

he r

isk.

Thi

s as

sess

men

t ne

eds

to b

e do

ne b

y ev

alua

ting

both

the

like

lihoo

dof

the

ris

k be

ing

real

ised

, and

of t

he im

pact

ifth

e ri

sk is

rea

lised

. A

cat

egor

izat

ion

of h

igh

/ med

ium

/ lo

w in

res

pect

of e

ach

may

be

suffi

cien

t, an

d sh

ould

be

the

min

imum

leve

l of c

ateg

oris

atio

n –

this

resu

lts in

a “

3x3”

risk

mat

rix.

A m

ore

deta

iled

anal

ytic

al s

cale

may

be

appr

opri

ate,

esp

ecia

lly if

cle

ar q

uant

itativ

e ev

alua

tion

can

be a

pplie

d to

the

par

ticul

ar r

isk

-“5

x5”

mat

rice

s ar

e of

ten

used

, with

impa

ct o

n a

scal

e of

“in

sign

ifica

nt /

min

or /

mod

erat

e/ m

ajor

/ cat

astr

ophi

c”an

d lik

elih

ood

on a

sca

le o

f “r

are

/ unl

ikel

y / p

ossi

ble

/ lik

ely

/ alm

ost

cert

ain”

. T

here

is n

o ab

solu

te s

tand

ard

for

the

scal

e of

ris

k m

atri

ces

-th

e or

gani

satio

n sh

ould

rea

ch a

judg

emen

t ab

out

the

leve

l of a

naly

sis

that

it fi

nds

mos

t pr

actic

able

for

its c

ircu

mst

ance

s.

2. R

isk

Impa

ct &

Sco

ring

:

It is

impo

rtan

t to

ass

ess

the

pote

ntia

l con

sequ

ence

s if

the

risk

s w

ere

to m

ater

ialis

e (ie

occu

r).

The

as

sess

men

t ne

eds

to b

e bo

th in

ter

ms

of li

kelih

ood

(ieth

e pr

obab

ility

tha

t it

will

hap

pen)

and

impa

ct.

Impa

ct n

eeds

to

cons

ider

bot

h fin

anci

al a

nd n

on-fi

nanc

ial c

onse

quen

ces.

Each

ris

k ne

eds

to b

e sc

ored

for

both

impa

ct, p

roba

bilit

y an

d pr

oduc

t (ie

impa

ct s

core

x p

roba

bilit

y sc

ore)

. T

he r

atin

g is

ran

ked

as a

ppro

pria

te fo

r th

e or

gani

satio

n an

d ca

n be

num

eric

al a

nd/o

r de

scri

ptiv

e (e

gbr

oade

ned

to r

ange

from

‘ver

y lo

w’/1

thr

ough

to

‘ver

y hi

gh’/5

; or

sim

plifi

ed t

o hi

gh/m

ediu

m/lo

w).

An

exam

ple

is il

lust

rate

d in

box

es 7

,8 &

9 a

bove

.

5. P

rodu

ct S

core

.T

he p

rodu

ct is

the

val

ue o

f:(Im

pact

Sco

re x

Lik

elih

ood

Scor

e)U

se t

he ‘p

rodu

ct’v

alue

to

dete

rmin

e th

e ov

eral

l ris

k va

lue

/ ris

k st

atus

.

Ran

geD

escr

ipti

on17

-25

V. H

igh

11-1

6H

igh

5-10

Med

ium

3-4

Low

1-2

V. L

ow

3. Im

pact

Cri

teri

a.(T

he e

ffect

the

ris

k w

ould

hav

e if

it oc

curr

ed)

Scor

eR

ange

Des

crip

tion

(in

per

iod)

5V

.hig

hSe

vere

4H

igh

Sign

ifica

nt3

Med

ium

Mod

erat

e2

Low

Min

or1

V. L

owIn

sign

ifica

nt

6. R

isk

Mat

rix

A s

impl

e w

ay o

f rec

ordi

ng a

nd

sum

mar

isin

g th

e sc

ores

is t

o us

e a

risk

m

atri

x, w

hich

can

be

limite

d to

spe

cific

po

licie

s/pr

ojec

ts, o

r se

gmen

ted

acro

ss

busi

ness

uni

ts /

area

s of

wor

k.


I NUMERICAL DIAGNOSIS - OVERVIEW


General

Emerging Systemic Risks in the 21st Century: An Agenda for Action OECD, 2003, ISBN: 9264199470

Risk in Social Science Peter Taylor-Gooby & Jens Zinn, Oxford University Press, 2006. ISBN: 0199285969

Normal Accidents – Living with high risk technologies Charles Perrow, Princeton University Press, 1999. ISBN: 0691004129

Risk John Adams, UCL Press, 1995. ISBN: 1857280687

On the Psychology of Military Incompetence Norman Dixon, Pimlico, 1994, ISBN: 0712658890.

Freakonomics Steven Levitt & Stephen Dubner, Penguin, 2005, ISBN: 0141019018

Reith Lecture on Risk, Lord Giddens, 1999 http://www.bbc.co.uk/radio4/reith1999/lecture2.shtml

House of Lords debate on “Government Policy on the Management of Risk”, 6 November 2006. Hansard, http://www.publications.parliament.uk/pa/ld200405/ldhansrd/pdvn/lds06/text/61106-gc0001.htm - 06110624000003

Key sources

The Orange Book: Management of Risk – Principles and Concepts HM Treasury, 2004.

Management of Risk: Guidance for Practitioners Office of Government Commerce, 2002.

Management of risks to the public - appraisal guidance HM Treasury, 2005.

Risk: good practice in government HM Government, 2006.

Risk: good practice in government (volume 2) HM Government, 2006.

Project Risk Management - Processes, Techniques and Insights Chris Chapman and Stephen Ward, John Wiley & Sons, 2003. ISBN: 0470853557

BIBLIOGRAPHY

Date post:	24-Jul-2018
Category:	Documents
Upload:	vuthu
View:	214 times
Download:	0 times

5IJOLJOH BCPVU SJTL .BOBHJOH ZPVS SJTL...

Documents